Apple Issues Security Updates After Two WebKit Flaws Found Exploited in the Wild

Apple on Friday released security updates for iOS, iPadOS, macOS, tvOS, watchOS, visionOS and Safari to address two flaws that it said have been exploited in the wild, one of which is the same flaw that Google patched in Chrome earlier this week, according to The Hacker News. The vulnerabilities are CVE-2025-43529, a use-after-free in WebKit, and CVE-2025-14174, a memory corruption issue in WebKit, with CVE-2025-14174 carrying a CVSS score of 8.8.

Apple said the shortcomings “may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26.” The updates affect iOS 26.2 and iPadOS 26.2, iOS 18.7.3 and iPadOS 18.7.3, macOS Tahoe 26.2, tvOS 26.2, watchOS 26.2, visionOS 26.2 and Safari 26.2, addressing nine zero-day vulnerabilities exploited in the wild in 2025.

Found by Apple SEAR and Google Threat Analysis Group, with Apple crediting TAG for CVE-2025-43529 and noting the Chrome patch ties to CVE-2025-14174, the researchers described the flaws as likely weaponised in mercenary spyware campaigns across WebKit-based browsers.